PatchVault › Errors › Vibe-coded app security

remote: error: GH013: Repository rule violations found for refs/heads/main. — Push cannot contain secrets

GitHub push protection found a supported secret (API key, token, private key) in one of the commits you pushed, and blocked the push.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/vibe-security-scan.py) .

Why it happens

The secret is in your commit history, not just the latest diff. Treat it as exposed: rotate it first, then remove it from the commits. Don't use the unblock link for a real, active key.

Manual fix

# 1) rotate the key at the provider
# 2) move it to an env var / secret store
# 3) remove it from the unpushed commits
git reset --soft origin/main   # or amend / interactive rebase
git commit -m 'remove secret' && git push

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

• GitHub Docs: push protection

Related errors

• Supabase "new row violates row-level security policy"
• Supabase rls_disabled_in_public: table publicly accessible

Full guide and free terminal scanner: Vibe-coded app security fix bundle. Last checked 2026-10-31.